The invention relates to messages exchanged in cellular radio communication systems. In general, these messages are exchanged between a message service center and a plurality of mobile stations. Each mobile station is composed of a terminal cooperating with a microprocessor user card called subscriber identity module (SIM).
More specifically, the invention relates to a particular enhanced message structure and a method for synchronizing and ensuring security when exchanging enhanced messages having this structure.
In the field of cellular radio communication, the GSM standard (global system for mobile public communications operating in the 900 MHz band) is known, primarily in Europe.
The invention applies, in particular, but not exclusively, to a system according to this GSM standard.
In general, a terminal is a piece of physical equipment used by a network user to access the telecommunications services offered. There are a number of different terminal types such as portables or even mobiles mounted on vehicles.
When a terminal is used by a user, the latter must connect his user card (SIM module), which is generally in the form of a smart card, to the terminal.
The user card supports a principal telephone application (for example the GSM application) which allows it, as well as the terminal to which it is connected in the cellular communications system, to operate. In particular, the user card provides the terminal with which it is connected with a unique subscriber identifier (or IMSI identifier, standing for xe2x80x9cInternational Mobile Subscriber Identityxe2x80x9d). For this purpose, the user card includes command execution means (for example a microprocessor and a program memory) and data storage means (for example a data storage).
The IMSI identifier, and all the individual information about the subscriber, to be used by the terminal, are stored in the data storage means of the SIM module. This enables each terminal to be used with any SIM module.
In certain known systems, particularly in a GSM system, there is a short message service (SMS) for sending short messages to mobile stations. These messages are transmitted by a short message service center (SMS-C).
When a mobile station receives a short message, it stores it in the data storage means of its SIM module. The principal telephone application of each SIM module handles each short message received.
Originally, the only function of a message was to provide information to the subscriber, generally via a terminal display screen. Messages that have this single function, known as short messages, thus contain only raw data.
Subsequently, an enhanced short message system (ESMS) was designed in which two types of short messages could be sent, namely the normal messages referred to above and enhanced messages which could contain commands.
Thus, the proposal has already been made that commands for updating or reconfiguring this SIM module remotely be transmitted to an SIM module via enhanced messages. In other words, commands encapsulated in enhanced messages enable the main telephone application of the SIM module to be modified. In this way, the SIM module can be reconfigured without having to bring it to a point of sale (and hence the SIM module can execute administrative commands when it is in the application phase).
It has also been proposed that the SIM module serve as a support for applications other than the principal telephone application such as in particular vehicle renting, payment, or loyalty applications.
Since the commands belonging to these other applications are contained in enhanced messages, which are thus external to the SIM module, these other applications are known as remote or OTA (xe2x80x9cOver The Airxe2x80x9d). On the other hand, the principal telephone application, whose commands are contained in the SIM module data storage means, is known as xe2x80x9clocal.xe2x80x9d The commands are also known as xe2x80x9clocalxe2x80x9d or xe2x80x9cremotexe2x80x9d depending on whether the application to which they belong is itself local or remote.
Hence, remote applications (renting, payment, reconfiguration of principal telephone application, etc.) can be executed with these remote commands.
It is clear that this recent remote application (or OTA application) concept is highly advantageous for the subscriber. The latter is able to carry out numerous applications such as renting a vehicle or paying for a service very easily simply by inserting his SIM module into a terminal.
In other words, the SIM module is made to do something different (essentially, more commands) that what it is normally able to do once it is in its application phase, namely once it is inserted into a cellular telephone in the user""s hand.
This enhanced working capacity of the SIM module entails particular security requirements. This mechanism, which is in fact an additional gateway into the SIM module, should prevent any person from carrying out actions in the SIM module from which he is normally prohibited.
Resynchronization, uniqueness of each message, integrity of each message, and authenticity of the transmitting entity are some of the particular security requirements linked to the utilization of enhanced messages.
This is because it is important to be able to resynchronize the message source and the SIM module if there are transmission problems on the network. Due to transmission problems in the enhanced message channel, neither the path of an enhanced message nor the transmission sequence of several enhanced messages can be guaranteed.
The requirement that each message be unique avoids replaying a message either accidentally (indeed, the path followed by an enhanced message is such that a given message could be transmitted several times to an SIM module) or intentionally (i.e. fraudulently with the idea of having the SIM module execute the same command sequence, such as the commands enabling a prepaid telephone unit meter in the SIM module to be recredited, several times in succession).
The requirement of integrity of each message prevents a message from being corrupted either accidentally (also due to the transmission path between the message service center and the mobile station) or intentionally (with the idea of modifying a message and forcing it to carry out other actions more sensitive than those planned by the message source).
The requirement that the transmitting entity be authentic ensures that it is indeed authorized to send enhanced messages. This remote application mechanism must be reserved for particular transmitters (such as operators and suppliers of services).
The recent remote application concept as currently implemented proves not to meet all these particular security requirements.
The only proposal made to date has been to introduce a checksum into each enhanced message and run a check procedure in which a secret code is presented before remote commands contained in the enhanced message are executed.
Clearly, this solution is incomplete and thus unsatisfactory.
First of all, the use of a checksum, which is a relatively basic solution, only ensures that the transmission has been carried out correctly.
Also, procedures of the secret code checking type do not offer sufficient security guarantees if an enhanced message is intercepted. Since the identifier information does not vary from one message to another, it is easy for an unauthorized person to replay a message, and pass off a fraudulently intercepted message as authentic.
Finally, this known solution does not meet the other requirements listed above, namely resynchronization and integrity of the messages.
The goal of the invention is to overcome these drawbacks of the prior art.
More specifically, one of the goals of the present invention is to provide a method for synchronizing and ensuring security of an exchange of enhanced messages and a corresponding enhanced message structure enabling the message source and the SIM module to be resynchronized if there are transmission problems on the network.
Another goal of the invention is to provide such a method and such an enhanced message structure ensuring uniqueness of each enhanced message transmitted.
Another goal of the invention is to provide such a method and such an enhanced message structure that ensure the integrity of each enhanced message transmitted.
A supplementary goal of the invention is to provide such a method and such an enhanced message structure that ensure the authenticity of the entity transmitting the enhanced messages.
These goals, and others which will emerge hereinbelow, are achieved according to the invention with the aid of an enhanced message of the type transmitted by a message service center to a mobile station of a cellular radio communication system, the enhanced message including a header and a body, the body containing in particular a first field storing remote commands belonging to an application remote from the mobile station,
the mobile station constituting a terminal cooperating with a subscriber identification module, the terminal including means for receiving the enhanced message, the subscriber identification module including means for storing and processing the enhanced message received by the terminal, the subscriber identification module serving to support the remote application and including means for executing the remote commands,
the enhanced message being characterized in that the body also includes a second field (4) for storing the current value of a synchronization counter,
the current value of the synchronization counter being intended to be compared to a previous value of the synchronization counter stored in the subscriber identification module so that the enhanced message is accepted or rejected by the subscriber identification module depending on the result of comparing the current value with the previous value of the synchronization counter, the previous value being updated with the current value only once the enhanced message has been accepted by the subscriber identification module.
Thus, synchronization between the message service center and the subscriber identification module (or SIM module) is based on the use of a computer shared by these two entities. Each message transmitted to the SIM module contains the current value of this synchronization counter. This current value is unique for each message. The SIM module retains the previous synchronization counter value, which it compares to the current value contained in each message in order to accept or reject this message.
If there is a problem when the message is transmitted, the SIM module can resynchronize with the message source when the next message is sent because the current synchronization counter value is contained in each message.
If the SIM module supports several remote applications, each of them can be associated with a separate synchronization counter, in which case the SIM module stores the previous values of the various counters.
Advantageously, the body of the enhanced message also includes a third field storing a first piece of information pinpointing the location of the previous synchronization counter value in the subscriber identification module data storage means.
This is particularly useful where the SIM module supports several remote applications. In these cases, when it receives a message, it is the content of the third field that tells the SIM module which synchronization counter to use.
In a preferred embodiment of the invention, wherein the subscriber identification module data storage means have a hierarchical structure with at least three levels including at least the following three types of files:
master file;
dedicated file or secondary file placed under the master file,
elementary file placed under one of the dedicated files, known as parent dedicated file, or directly under the master file, known as parent master file,
an elementary system file (EF SMS System) specific to each remote application containing a second piece of information pinpointing the location of the previous synchronization counter value in the subscriber identification module data storage means,
the enhanced message is characterized in that the first piece of locating information contained in the third storage field is an identifier of a dedicated file or master file to which the elementary system file relates according to a predetermined search strategy in the data storage means.
Thus, each message includes an identifier enabling the SIM module to find the elementary system file with which the remote application transmitting this message is linked. This elementary system file also includes the previous synchronization counter value associated with this message-transmitting remote application.
Preferably, the body also includes a fourth field (6) storing a cryptogram, known as transmitted cryptogram, calculation of which at least partially involves the content of the second field stored the current synchronization counter value,
the transmitted cryptogram being intended to be compared with another cryptogram, known as local cryptogram, calculated by the subscriber identification module so that the enhanced message is accepted by the subscriber identification module if the transmitted and local cryptograms are identical, and rejected if they are not.
In other words, the use of a synchronization counter and a cryptogram is combined. This greatly enhances the security of message exchanges between the message service center and the SIM module.
The use of a cryptogram enables the SIM module to ensure that the transmitter of a message is indeed an authorized source (one speaks also of transmitter entity authenticity) and ensures the integrity of the message.
Moreover, synergy exists between the use of the synchronization counter and that of the cryptogram since calculation of the latter involves the current counter value.
First, since the current counter value is different for each message, the same message cannot be fraudulently replayed. In other words, the uniqueness of each message is ensured.
Also, since the current counter value is contained in the message, the SIM module knows which current value has been used to calculate the cryptogram and can thus calculate the comparison cryptogram (local cryptogram) on the same basis.
Finally, transmitting the current counter value in the message also ensures that a received message can be accepted even if the message or messages transmitted prior to it have not been received (or never arrived).
Advantageously, calculation of the transmitted and verification cryptograms also involves, at least partially, the content of the first field storing the remote commands.
In one advantageous embodiment of the invention, calculation of the transmitted and verification cryptograms involves at least the entire content of the second field storing the current synchronization counter value and the entire content of the first field storing the remote commands. This ensures the quality of the security process.
Preferably, the transmitted and verification cryptograms are calculated with a cryptographic function belonging to the group including:
the secret key cryptographic functions; and
the public key cryptographic functions.
Thus, the invention is not confined to the use of a particular type of cryptographic function.
Preferably, the subscriber identification module stores, in the subscriber identification module data storage means, a cryptographic function and an associated key which are specific to the remote application and enable the local cryptogram to be calculated,
the enhanced message is characterized in that the body of the enhanced message also includes a fifth field storing a third piece of information pinpointing the location in the data storage means where the cryptographic function and the associated key specific to the remote application are stored.
This is particularly useful in the case where the SIM module supports several remote applications, each associated with a different pair (cryptographic function/key) and where the SIM module stores the various pairs associated with these applications. In this case, when it receives a message, it is the content of the fifth field that tells the SIM module which pair (cryptographic function/key) to be used.
In a preferred embodiment of the invention, the third field also constitutes the fifth field, and the first piece of locating information also constitutes the third piece of locating information.
Thus, the content of the third field tells the SIM module not only which synchronization counter to use but also which pair (cryptographic function/key).
Advantageously, the body also includes a sixth field storing a checksum, known as transmitted checksum, calculation of which involves, at least in part, the contents of the first field storing remote commands,
the transmitted checksum being intended for comparison with another checksum known as local checksum, calculated by the subscriber identification module, so that the enhanced message is accepted by the subscriber identification module if the transmitted checksum and the local checksum are identical, and rejected if they are not.
This use of a checksum constitutes an additional security level. It enables a message that was modified accidentally for example to be rapidly rejected without cryptographic calculations having to be done.
Moreover, if the possibility of decoupling the cryptogram check from the counter check under certain conditions is provided, the xe2x80x9cchecksumxe2x80x9d field will, but with a very relative level of guarantee, itself ensure that the message has not been accidentally or intentionally corrupted. However it is clear that this possibility must be reserved for configurations where the logical security linked to remote applications limits the actions possible in the SIM module.
Advantageously, the subscriber identification module includes an input/output line over which it receives local commands belonging to an application local to the mobile station,
the enhanced message is characterized in that the remote commands contained in the first field of the enhanced message are substantially identical to the local commands received over the input/output line.
In this way, the SIM module can handle both types of commands, local and remote, without it being necessary to duplicate the executable code of the SIM module (this code is generally in the ROM or EEPROM).
The invention also relates to a method for synchronizing and ensuring security of enhanced messages exchanged between a message service center and a mobile station of a cellular radio communication system, each enhanced message including a header and a body, the body containing in particular a first field for storing remote commands belonging to a remote application of the mobile station,
the mobile station constituting a terminal cooperating with a subscriber identification module, the terminal including means for receiving the enhanced message, the subscriber identification module including means for storing and processing the enhanced message received by the terminal, the subscriber identification module serving to support the remote application and including means for executing the remote commands,
the method being characterized by having in particular the following steps:
the message service center transmits to the mobile station an enhanced message whose body also includes a second field in which the current value of a synchronization counter is stored;
the subscriber identification module of the mobile station compares the current synchronization counter value contained in the enhanced message with a previous synchronization counter value stored in the subscriber identification module;
the subscriber identification module accepts or rejects the enhanced message depending on the result of comparing the current with the previous synchronization counter values;
if the enhanced message has been accepted, the subscriber identification module updates the previous value with the current value.
Preferably, for each new enhanced message of the remote application transmitted by the message service center, the current synchronization counter value is incremented by a predetermined step,
and the enhanced message is accepted by the subscriber identification module only if the current synchronization counter value is higher than the previous value.
In other words, to prevent a message from being replayed, any new current value must be higher than that contained in the last accepted message (i.e. the previous value stored in the SIM module).
Preferably, the step in which the previous synchronization counter value is updated with the current value is carried out only if the difference between the current and previous values is less than a maximum predetermined increment.
Thus, the counter is prevented from being locked at its maximum value too rapidly. This increases the service life of the counter and prevents the type of attack in which the SIM module is quickly locked by bringing the counter to its maximum value. When it is locked in this way, the counter cannot be reset to zero by a remote application. It can be unlocked only by an administrative procedure which generates additional cost.
Advantageously, the method also includes the following step:
when the enhanced message is rejected by the subscriber identification module, the latter sends back to the message service center an enhanced message containing a specific error code telling the message service that the enhanced message that it previously transmitted was rejected due to a counter synchronization problem.
This is particularly the case when two successive messages, for example with the current counter values N and N+1 respectively, are not received in the order they were sent. If the first message received is accepted, the second message is rejected (as explained below) and the transmitting entity can advantageously be informed of the reason for rejection, namely a synchronization problem.
It will be understood that when the SIM module receives the first message (value N+1), the previous value that it stores is Nxe2x88x921. Hence the current value of the first message, equal to N+1, is greater than this value Nxe2x88x921. The previous value is then updated with the current value of the first message received, and when the SIM module receives the second message, the previous value it stored is hence N+1. Thus, the current value of the second message, equal to N, is less than this previous value, N+1, justifying rejection of this second message due to a synchronization problem.
Advantageously, the body of the enhanced message transmitted by the message service center to the mobile station also includes a third field storing a first piece of information pinpointing the storage location, in the subscriber identification module data storage means, of the previous synchronization counter value,
the comparison step by the subscriber identification module of the current and previous synchronization counter values is preceded by the following steps:
the subscriber identification module reads the first piece of locating information contained in the third field of the enhanced message;
the subscriber identification module deduces therefrom the storage location of the previous synchronization counter value;
the subscriber identification module reads, in the storage location, the previous synchronization counter value.
In a preferred embodiment of the invention, the body of the enhanced message transmitted by the message service center to the mobile station also includes a fourth field storing a cryptogram, known as transmitted cryptogram, calculated using at least part of the contents of the second field storing the current synchronization counter value,
and the method also includes the following steps:
the subscriber identification module calculates a local cryptogram, using at least in part the contents of the second field of the enhanced message;
the subscriber identification module compares the transmitted cryptogram to the local cryptogram so that the enhanced message is accepted if the transmitted and local cryptograms are identical and rejected if they are not.
Advantageously, the subscriber identification module stores, in the subscriber identification module data storage means, a cryptographic function and an associated key that are specific to the remote application enabling the local cryptogram to be calculated,
the method is characterized in that the body of the enhanced message transmitted by the message service center to the mobile station also includes a fifth field storing a third piece of information pinpointing the storage location, in the data storage means, of the cryptographic function and the associated key,
and in that the step in which the subscriber identification module calculates the local cryptogram has the following steps:
the subscriber identification module reads the third piece of locating information contained in the fifth field of the enhanced message;
the subscriber identification module deduces from this the storage location of the cryptographic function and the associated key;
the subscriber identification module calculates the local cryptogram, using the cryptographic function, the associated key, and at least part of the contents of the second field of the enhanced message.
In a preferred embodiment of the invention wherein the subscriber identification module data storage means possess a hierarchical structure with at least three levels having at least the following three types of files:
master file;
dedicated file, or secondary file placed under the master file,
elementary file placed under one of the dedicated files, known as parent dedicated file, or directly under the master file, known as parent master file,
the method being characterized in that an elementary system file (EF SMS System) specific to each remote application, contains a second piece of information pinpointing the location, in the subscriber identification module data storage means, of the previous synchronization counter value, of the cryptographic function, and of the associated key,
and in that the third field also constitutes the fifth field with the first piece of locating information also constituting the third piece of locating information,
and in that the first piece of locating information contained in the third storage field is an identifier of a dedicated file (DF) or master file (MF) to which the elementary system file (EF SMS System) relates according to a predetermined search strategy in the data storage means.
Advantageously, the body of the enhanced message transmitted by the message service center to the mobile station also includes a sixth field storing a checksum, known as transmitted checksum, calculation of which involves at least in part the contents of the first field storing remote commands,
with the process also including the following steps:
the subscriber identification module calculates a local checksum, using at least in part the contents of the first field of the enhanced message,
the subscriber identification module compares the transmitted checksum to the local checksum so that the enhanced message is accepted if the transmitted and local checksums are identical and rejected if they are not.